fix: support P-256 V2 session vouchers

.changelog/fix-p256-v2-session-vouchers.md

@@ -0,0 +1,5 @@
+---
+wallet-cli: patch
+---
+
+Support P-256 access keys for V2 MPP session vouchers.

package.json

@@ -39,9 +39,9 @@
   "dependencies": {
     "accounts": "0.14.11",
     "incur": "0.4.8",
-    "mppx": "0.7.0",
+    "mppx": "0.8.9",
     "undici": "8.5.0",
-    "viem": "2.53.1"
+    "viem": "2.54.0"
   },
   "devDependencies": {
     "@types/node": "25.9.2",

src/commands/fund.ts

@@ -101,10 +101,12 @@ async function fundingBalance(options: {
   const provider = createProvider({
     network: options.chainId === 42431 ? "testnet" : undefined,
   }) as CoreProvider.Provider & { getClient: () => unknown };
-  const rawBalance = (await Actions.token.getBalance(provider.getClient() as never, {
-    account: options.walletAddress as `0x${string}`,
-    token: tokenAddress(options.chainId),
-  })) as bigint;
+  const rawBalance = (
+    await Actions.token.getBalance(provider.getClient() as never, {
+      account: options.walletAddress as `0x${string}`,
+      token: tokenAddress(options.chainId),
+    })
+  ).amount;
 
   return {
     balance: formatMicroUnits(rawBalance.toString()),

src/commands/request.ts

@@ -1056,10 +1056,12 @@ async function assertSufficientSessionBalance(
   depositRaw: bigint,
 ) {
   const client = createTempoPublicClient(details.chainId === 42431 ? "testnet" : undefined);
-  const balance = (await Actions.token.getBalance(client as never, {
-    account: payer as `0x${string}`,
-    token: details.token as `0x${string}`,
-  })) as bigint;
+  const balance = (
+    await Actions.token.getBalance(client as never, {
+      account: payer as `0x${string}`,
+      token: details.token as `0x${string}`,
+    })
+  ).amount;
   if (balance >= depositRaw) return;
   throw paymentError(
     `Insufficient balance for session deposit: available=${formatTokenAmount(balance)} required=${formatTokenAmount(depositRaw)}`,
@@ -1570,4 +1572,4 @@ function parseSimpleToon(value: string) {
 
 function write(stdout: Pick<NodeJS.WriteStream, "write">, text: string) {
   stdout.write(text);
-}
+}

src/commands/transfer.ts

@@ -52,7 +52,7 @@ export async function transferTokens(options: {
   }
 
   const provider = createProvider({ network: options.options.network });
-  const call = Actions.token.transfer.call({
+  const call = Actions.token.transfer.call(provider.getClient() as never, {
     amount: parseUnits(args.amount, tokenDecimals()),
     token,
     to,

test/request.test.ts

@@ -3,9 +3,9 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 import { Challenge, Credential, Method, z } from "mppx";
-import { Mppx } from "mppx/client";
+import { Mppx, session as tempoSession } from "mppx/client";
 import { Keystore } from "accounts";
-import { decodeFunctionData } from "viem";
+import { createClient, custom, decodeFunctionData } from "viem";
 import { Abis as TempoAbis, Channel as TempoChannel, KeyAuthorizationManager } from "viem/tempo";
 import { afterEach, describe, expect, it } from "vitest";
 
@@ -489,6 +489,61 @@ describe("request command", () => {
       account: { accessKeyAddress: account.accessKeyAddress, keyType: "p256" },
       mode: "pull",
     });
+
+    if (!("account" in identity)) throw new Error("expected a stored access-key identity");
+    const client = createClient({
+      account: identity.account,
+      chain: { id: 4217 } as never,
+      transport: custom({
+        async request({ method }) {
+          if (method === "eth_chainId") return "0x1079";
+          throw new Error(`unexpected RPC request: ${method}`);
+        },
+      }),
+    });
+    const payment = tempoSession({
+      account: identity.account,
+      decimals: 0,
+      getClient: () => client,
+    });
+    const descriptor = {
+      authorizedSigner: account.accessKeyAddress,
+      expiringNonceHash: `0x${"22".repeat(32)}` as `0x${string}`,
+      operator: "0x0000000000000000000000000000000000000000",
+      payee: "0x0000000000000000000000000000000000000002",
+      payer: account.address,
+      salt: `0x${"11".repeat(32)}` as `0x${string}`,
+      token: "0x20C000000000000000000000b9537d11c60E8b50",
+    } as const;
+    const credential = await payment.createCredential({
+      challenge: {
+        id: "test",
+        intent: "session",
+        method: "tempo",
+        realm: "rpc.mpp.tempo.xyz",
+        request: {
+          amount: "1",
+          currency: descriptor.token,
+          methodDetails: {
+            chainId: 4217,
+            escrowContract: "0x4d50500000000000000000000000000000000000",
+            sessionProtocol: "v2",
+          },
+          recipient: descriptor.payee,
+        },
+      } as never,
+      context: {
+        action: "voucher",
+        cumulativeAmountRaw: "1",
+        descriptor,
+      },
+    });
+    const payload = Credential.deserialize<Record<string, unknown>>(credential).payload;
+
+    expect(payload).toMatchObject({
+      action: "voucher",
+      descriptor: { authorizedSigner: account.accessKeyAddress },
+    });
   });
 
   it("keeps v2 session descriptors for reuse", async () => {
@@ -667,4 +722,4 @@ async function readSeenRequest(request: IncomingMessage): Promise<SeenRequest> {
     method: request.method ?? "",
     url: request.url ?? "",
   };
-}
+}